5aa49011c4910dd8db757b951f42f9862fda1e0a2684b24eae4c7444e1d97acb

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b157c23aebe6119dc01eee0a55897c30N.exe
Size

697KB
MD5

b157c23aebe6119dc01eee0a55897c30
SHA1

798b6f3ebe81883a946a9db9a91a69c02fd43b65
SHA256

5aa49011c4910dd8db757b951f42f9862fda1e0a2684b24eae4c7444e1d97acb
SHA512

b4bfa9215bb1115b1cbd554a2dd03c68d3a8d5ece5b724650e6a2f461be12d5ed19b063ad1130fc183699b6b2eee3ab6b1994c6ec981ffc1e2668b9e9e575dc5
SSDEEP

12288:7ytbV3kSoXaLnTosllBuz6pqlq7TC2BSJBqYr5cUmWuGj0X0b4zAB42rWsmv:6b5kSYaLTVll4G7TjiJ5czWu+0oH424v

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4488	cmd.exe
4704	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4704	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2632	b157c23aebe6119dc01eee0a55897c30N.exe
2632	b157c23aebe6119dc01eee0a55897c30N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	b157c23aebe6119dc01eee0a55897c30N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 4488	2632	b157c23aebe6119dc01eee0a55897c30N.exe	83
PID 2632 wrote to memory of 4488	2632	b157c23aebe6119dc01eee0a55897c30N.exe	83
PID 4488 wrote to memory of 4704	4488	cmd.exe	85
PID 4488 wrote to memory of 4704	4488	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\b157c23aebe6119dc01eee0a55897c30N.exe
"C:\Users\Admin\AppData\Local\Temp\b157c23aebe6119dc01eee0a55897c30N.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\b157c23aebe6119dc01eee0a55897c30N.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...